Sounds like they didn't do a security wipe before sending!
Ask for the password and request that they remove their phone from their BBID, otherwise it will be connected to their BlackBerry Protect account